From b9c2b9322fc5b1b312b93b345a835a54ff76f6d6 Mon Sep 17 00:00:00 2001 From: Steven Nguyen Date: Fri, 14 Jul 2023 16:17:05 -0700 Subject: [PATCH] Don't set password when oauth2 creates a user Setting a password can cause problems with other APIs that expect the password to be null. In addition, it doesn't match the implementation for the other APIs that create a user without a password (Create Magic URL Session, Create Phone Session, Create Anonymous Session, etc). --- app/controllers/api/account.php | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/app/controllers/api/account.php b/app/controllers/api/account.php index 2ac517cf24..0f9db07e9f 100644 --- a/app/controllers/api/account.php +++ b/app/controllers/api/account.php @@ -564,7 +564,6 @@ App::get('/v1/account/sessions/oauth2/:provider/redirect') try { $userId = ID::unique(); - $password = Auth::passwordHash(Auth::passwordGenerator(), Auth::DEFAULT_ALGO, Auth::DEFAULT_ALGO_OPTIONS); $user->setAttributes([ '$id' => $userId, '$permissions' => [ @@ -575,8 +574,7 @@ App::get('/v1/account/sessions/oauth2/:provider/redirect') 'email' => $email, 'emailVerification' => true, 'status' => true, // Email should already be authenticated by OAuth2 provider - 'passwordHistory' => $passwordHistory > 0 ? [$password] : null, - 'password' => $password, + 'password' => null, 'hash' => Auth::DEFAULT_ALGO, 'hashOptions' => Auth::DEFAULT_ALGO_OPTIONS, 'passwordUpdate' => null,